29 pay-per-call DNS, SEO, SSL, security, and dev tools for AI agents. x402, no API key.
Déduit des transports déclarés par cette annonce (streamable-http). Un client absent de cette liste n’est pas écarté pour autant — c’est simplement quelque chose que Forge ne peut pas confirmer.
La vérification confirme l’identité de l’éditeur (la propriété du dépôt), pas la sûreté du code. L’analyse de sécurité couvre les CVE connues et les scripts d’installation suspects.
Lu depuis un véritable échange MCP initialize → tools/list contre l’endpoint déclaré. Aucun outil n’a été invoqué — tools/list est l’appel d’introspection en lecture seule que le protocole prévoit pour cela. Cela reflète ce que le serveur annonçait à cet instant ; un endpoint hébergé n’est figé sur aucune version et peut changer sans préavis.
https://papacasper.com/mcp29 outils · 104 msurl_to_markdownFetch a URL and return its main text content as clean, readable plain text/markdown-ish output. Strips scripts, styles, and HTML tags.Fetch a URL and return its main text content as clean, readable plain text/markdown-ish output. Strips scripts, styles, and HTML tags.
| Paramètre | Type | Description |
|---|---|---|
| url* | string | The URL to fetch |
security_headers_auditFetch a URL and audit its response for security-relevant HTTP headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Flags missing/misconfigured headers with a score.Fetch a URL and audit its response for security-relevant HTTP headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Flags missing/misconfigured headers with a score.
| Paramètre | Type | Description |
|---|---|---|
| url* | string | The URL to audit |
redirect_chain_checkFollow a URL through every HTTP redirect hop and report the full chain, final destination, and issues like redirect loops, too many hops, or HTTPS-to-HTTP downgrades.Follow a URL through every HTTP redirect hop and report the full chain, final destination, and issues like redirect loops, too many hops, or HTTPS-to-HTTP downgrades.
| Paramètre | Type | Description |
|---|---|---|
| url* | string | The starting URL to trace |
page_performance_checkFetch a URL and measure time-to-first-byte, total fetch time, and response size. Flags missing compression, missing Cache-Control, oversized payloads, and slow TTFB.Fetch a URL and measure time-to-first-byte, total fetch time, and response size. Flags missing compression, missing Cache-Control, oversized payloads, and slow TTFB.
| Paramètre | Type | Description |
|---|---|---|
| url* | string | The URL to measure |
cors_policy_checkSend a probe request with a foreign Origin header to a URL and report its CORS response headers. Flags wildcard-origin + credentials combinations and arbitrary-origin reflection, both common CORS misconfigurations.Send a probe request with a foreign Origin header to a URL and report its CORS response headers. Flags wildcard-origin + credentials combinations and arbitrary-origin reflection, both common CORS misconfigurations.
| Paramètre | Type | Description |
|---|---|---|
| url* | string | The URL to probe |
structured_data_extractFetch a URL and extract structured data deterministically: JSON-LD blocks, OpenGraph/meta tags, and optional caller-supplied CSS-selector fields (e.g. { price: '.product-price', title: 'h1' }). No LLM involved — pure HTML parsing via CSS selectors, so results are exact matches only, not summarized…Fetch a URL and extract structured data deterministically: JSON-LD blocks, OpenGraph/meta tags, and optional caller-supplied CSS-selector fields (e.g. { price: '.product-price', title: 'h1' }). No LLM involved — pure HTML parsing via CSS selectors, so results are exact matches only, not summarized…
| Paramètre | Type | Description |
|---|---|---|
| url* | string | The URL to extract from |
| selectors | object | Optional map of field name -> CSS selector (e.g. { price: '.product-price', headline: 'h1' }). Each field returns an array of matched, whitespace-normalized te… |
| attr | string | Optional HTML attribute to extract instead of text content (e.g. 'href', 'src', 'content'). Applies to all selector fields in this call. |
tech_stack_fingerprintFetch a URL and fingerprint its likely tech stack from response headers (server, x-powered-by, x-generator) and HTML markers (generator meta tag, framework/CMS-specific script or class patterns). Best-effort — not exhaustive, no additional paths are probed.Fetch a URL and fingerprint its likely tech stack from response headers (server, x-powered-by, x-generator) and HTML markers (generator meta tag, framework/CMS-specific script or class patterns). Best-effort — not exhaustive, no additional paths are probed.
| Paramètre | Type | Description |
|---|---|---|
| url* | string | The URL to fingerprint |
ai_crawler_policy_checkCheck a site's robots.txt for explicit directives targeting known AI crawlers (GPTBot, ClaudeBot, CCBot, PerplexityBot, Google-Extended, Bytespider, Amazonbot, and others used for LLM training or AI search/answer products), and check for an llms.txt file. Useful for publishers deciding whether thei…Check a site's robots.txt for explicit directives targeting known AI crawlers (GPTBot, ClaudeBot, CCBot, PerplexityBot, Google-Extended, Bytespider, Amazonbot, and others used for LLM training or AI search/answer products), and check for an llms.txt file. Useful for publishers deciding whether thei…
| Paramètre | Type | Description |
|---|---|---|
| url* | string | Any URL on the site to check (origin is derived from it) |
seo_auditFetch a URL and run an SEO audit: title/meta description length, canonical tag, Open Graph + Twitter Card tags, html lang attribute, viewport meta, heading structure, image alt-text coverage, internal/external link counts and generic-anchor-text detection, robots meta (noindex/nofollow), structured…Fetch a URL and run an SEO audit: title/meta description length, canonical tag, Open Graph + Twitter Card tags, html lang attribute, viewport meta, heading structure, image alt-text coverage, internal/external link counts and generic-anchor-text detection, robots meta (noindex/nofollow), structured…
| Paramètre | Type | Description |
|---|---|---|
| url* | string | The URL to audit |
check_robots_sitemapCheck whether a site has a valid robots.txt and sitemap.xml, and return their raw contents (truncated).Check whether a site has a valid robots.txt and sitemap.xml, and return their raw contents (truncated).
| Paramètre | Type | Description |
|---|---|---|
| url* | string | Any URL on the site to check (origin is derived from it) |
broken_link_checkCrawl a site starting from a URL (same-origin pages only, bounded by maxPages) and check every linked URL for broken status codes. Returns broken links with the page(s) they were found on. Note: some external sites (e.g. social platforms) block automated HEAD/GET requests and may show up as false p…Crawl a site starting from a URL (same-origin pages only, bounded by maxPages) and check every linked URL for broken status codes. Returns broken links with the page(s) they were found on. Note: some external sites (e.g. social platforms) block automated HEAD/GET requests and may show up as false p…
| Paramètre | Type | Description |
|---|---|---|
| url* | string | Starting URL to crawl |
| maxPages | number | Max same-origin pages to crawl (default 20, capped at 50) |
| checkExternal | boolean | Also check links pointing off-site (default true; crawling never follows off-site links) |
favicon_manifest_checkCheck a site for favicon, apple-touch-icon, web app manifest, and theme-color presence — a quick completeness check for browser/OS chrome and PWA metadata.Check a site for favicon, apple-touch-icon, web app manifest, and theme-color presence — a quick completeness check for browser/OS chrome and PWA metadata.
| Paramètre | Type | Description |
|---|---|---|
| url* | string | Any URL on the site to check (origin is derived from it) |
json_ld_schema_validatorFetch a URL, extract every JSON-LD (<script type="application/ld+json">) block, and validate basic structure — @context/@type presence plus required fields for common schema.org types (Article, Product, Organization, WebSite, LocalBusiness, BreadcrumbList, FAQPage). Reports per-block errors rather…Fetch a URL, extract every JSON-LD (<script type="application/ld+json">) block, and validate basic structure — @context/@type presence plus required fields for common schema.org types (Article, Product, Organization, WebSite, LocalBusiness, BreadcrumbList, FAQPage). Reports per-block errors rather…
| Paramètre | Type | Description |
|---|---|---|
| url* | string | The URL to check |
sitemap_url_validatorParse a site's sitemap.xml (following one level of sitemap-index nesting) and check the HTTP status of every listed URL. Concurrency-limited, capped at 200 URLs checked per call. Reports broken/redirecting URLs found in the sitemap.Parse a site's sitemap.xml (following one level of sitemap-index nesting) and check the HTTP status of every listed URL. Concurrency-limited, capped at 200 URLs checked per call. Reports broken/redirecting URLs found in the sitemap.
| Paramètre | Type | Description |
|---|---|---|
| url* | string | URL of the sitemap.xml to validate (or any page URL — /sitemap.xml on that origin is used) |
domain_health_checkCheck a domain's registration expiry (via WHOIS) and DNS health: nameservers, A/AAAA, MX, SPF, and DMARC records. Flags common misconfigurations.Check a domain's registration expiry (via WHOIS) and DNS health: nameservers, A/AAAA, MX, SPF, and DMARC records. Flags common misconfigurations.
| Paramètre | Type | Description |
|---|---|---|
| domain* | string | Bare domain to check, e.g. example.com (no scheme/path) |
dns_propagation_checkQuery a DNS record for a domain against several major public resolvers (Google, Cloudflare, Quad9, OpenDNS) in parallel and compare the answers. Flags mismatches, which usually mean propagation is still in progress after a DNS change.Query a DNS record for a domain against several major public resolvers (Google, Cloudflare, Quad9, OpenDNS) in parallel and compare the answers. Flags mismatches, which usually mean propagation is still in progress after a DNS change.
| Paramètre | Type | Description |
|---|---|---|
| domain* | string | Bare domain to query, e.g. example.com |
| recordType | string | Record type: A, AAAA, MX, TXT, NS, or CNAME (default A) |
ip_geolocation_asn_lookupResolve a hostname to its IPv4 addresses and look up each one's ASN, network prefix, country code, and network owner via Team Cymru's DNS-based WHOIS service (no API key). Country-level only — not city/street geolocation.Resolve a hostname to its IPv4 addresses and look up each one's ASN, network prefix, country code, and network owner via Team Cymru's DNS-based WHOIS service (no API key). Country-level only — not city/street geolocation.
| Paramètre | Type | Description |
|---|---|---|
| host* | string | Hostname or bare IPv4 address to look up |
email_deliverability_checkDeep-dive email deliverability check for a domain: MX records + reverse-DNS (PTR) on each MX host, common DKIM selector probing, SPF lookup-count (RFC 7208 caps at 10), DMARC policy strength, and DNSBL blacklist lookups (Spamhaus Zen, SpamCop, Barracuda) on MX IPs. Note: public-resolver DNSBL queri…Deep-dive email deliverability check for a domain: MX records + reverse-DNS (PTR) on each MX host, common DKIM selector probing, SPF lookup-count (RFC 7208 caps at 10), DMARC policy strength, and DNSBL blacklist lookups (Spamhaus Zen, SpamCop, Barracuda) on MX IPs. Note: public-resolver DNSBL queri…
| Paramètre | Type | Description |
|---|---|---|
| domain* | string | Bare domain to check, e.g. example.com |
domain_availability_checkCheck whether a domain is registered, plus scan common typo-squat variants (adjacent-key substitution, letter omission/doubling, transposition) across popular TLDs (.com, .net, .org, .io, .co, .ai, .app, .dev) for brand-protection or domain-flipping research. WHOIS-based; capped at 40 variants chec…Check whether a domain is registered, plus scan common typo-squat variants (adjacent-key substitution, letter omission/doubling, transposition) across popular TLDs (.com, .net, .org, .io, .co, .ai, .app, .dev) for brand-protection or domain-flipping research. WHOIS-based; capped at 40 variants chec…
| Paramètre | Type | Description |
|---|---|---|
| domain* | string | Bare domain to check, e.g. example.com |
| checkSquats | boolean | Also scan typo-squat variants (default true) |
ssl_cert_checkConnect to a host over TLS and report its certificate's expiry date, days remaining, issuer, and subject.Connect to a host over TLS and report its certificate's expiry date, days remaining, issuer, and subject.
| Paramètre | Type | Description |
|---|---|---|
| hostname* | string | Hostname to check, e.g. papacasper.com (no scheme/path) |
| port | number | TLS port to connect to (default 443) |
check_open_portsTCP-connect scan a host for open ports. Defaults to a list of ~20 common service ports (SSH, HTTP/S, mail, DBs, etc.) if none are given. For checking your own infrastructure's exposure — capped at 100 ports per call.TCP-connect scan a host for open ports. Defaults to a list of ~20 common service ports (SSH, HTTP/S, mail, DBs, etc.) if none are given. For checking your own infrastructure's exposure — capped at 100 ports per call.
| Paramètre | Type | Description |
|---|---|---|
| host* | string | Hostname or IP to scan (no scheme) |
| ports | array | Specific ports to check. Defaults to a common-ports list. Max 100 ports per call. |
websocket_endpoint_checkTest a WebSocket endpoint (ws:// or wss://): attempts the handshake, reports success/failure, time-to-open in ms, and close code/reason. Useful for verifying a WebSocket server is reachable and completes its upgrade handshake before you wire real traffic to it.Test a WebSocket endpoint (ws:// or wss://): attempts the handshake, reports success/failure, time-to-open in ms, and close code/reason. Useful for verifying a WebSocket server is reachable and completes its upgrade handshake before you wire real traffic to it.
| Paramètre | Type | Description |
|---|---|---|
| url* | string | WebSocket URL to test, e.g. wss://example.com/socket |
domain_reportBundle: runs seo_audit, domain_health_check (WHOIS + DNS: nameservers, A/AAAA, MX, SPF, DMARC), and email_deliverability_check (DKIM, SPF lookup-count, DMARC strength, DNSBL) against a domain in one call, one charge. Cheaper than calling the three tools separately. Each sub-check reports independen…Bundle: runs seo_audit, domain_health_check (WHOIS + DNS: nameservers, A/AAAA, MX, SPF, DMARC), and email_deliverability_check (DKIM, SPF lookup-count, DMARC strength, DNSBL) against a domain in one call, one charge. Cheaper than calling the three tools separately. Each sub-check reports independen…
| Paramètre | Type | Description |
|---|---|---|
| domain* | string | Bare domain to report on, e.g. example.com (no scheme/path) |
safe_browsing_checkCheck a URL against Google Safe Browsing's malware/phishing/unwanted-software/PUA blocklists. Requires GOOGLE_SAFE_BROWSING_API_KEY to be configured server-side (free Google Cloud API key).Check a URL against Google Safe Browsing's malware/phishing/unwanted-software/PUA blocklists. Requires GOOGLE_SAFE_BROWSING_API_KEY to be configured server-side (free Google Cloud API key).
| Paramètre | Type | Description |
|---|---|---|
| url* | string | The URL to check |
ssl_labs_gradeFull SSL Labs-style TLS assessment: overall letter grade, protocol support (TLS 1.0-1.3), cipher strength, certificate chain issues, and known vulnerabilities (Heartbleed, POODLE, etc.) for each endpoint. Slower than ssl_cert_check (can take up to ~90s on a cold cache; SSL Labs caches results for 2…Full SSL Labs-style TLS assessment: overall letter grade, protocol support (TLS 1.0-1.3), cipher strength, certificate chain issues, and known vulnerabilities (Heartbleed, POODLE, etc.) for each endpoint. Slower than ssl_cert_check (can take up to ~90s on a cold cache; SSL Labs caches results for 2…
| Paramètre | Type | Description |
|---|---|---|
| hostname* | string | Hostname to assess, e.g. example.com (no scheme/path) |
pagespeed_insightsRun Google's real PageSpeed Insights (Lighthouse + Chrome UX Report) against a URL: performance score, Core Web Vitals (LCP, CLS, INP/TBT), and real-user field data where available. Authoritative version of a local timing check — hits Google's own infrastructure. Works without an API key at low vol…Run Google's real PageSpeed Insights (Lighthouse + Chrome UX Report) against a URL: performance score, Core Web Vitals (LCP, CLS, INP/TBT), and real-user field data where available. Authoritative version of a local timing check — hits Google's own infrastructure. Works without an API key at low vol…
| Paramètre | Type | Description |
|---|---|---|
| url* | string | The URL to test |
| strategy | string | Device strategy (default mobile) |
package_vulnerability_checkLook up a package (optionally pinned to a version) against OSV.dev's aggregated vulnerability database (GitHub Advisories, PyPA, RustSec, Go vuln DB, etc.) for known CVEs/advisories. Supports npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet, and Packagist ecosystems. Useful before adding a dependen…Look up a package (optionally pinned to a version) against OSV.dev's aggregated vulnerability database (GitHub Advisories, PyPA, RustSec, Go vuln DB, etc.) for known CVEs/advisories. Supports npm, PyPI, crates.io, RubyGems, Go, Maven, NuGet, and Packagist ecosystems. Useful before adding a dependen…
| Paramètre | Type | Description |
|---|---|---|
| ecosystem* | string | Package ecosystem |
| name* | string | Package name |
| version | string | Optional exact version to check; omit to check the package generally |
github_repo_health_checkCheck a GitHub repository's health signals: stars, forks, open issues, license, archived/disabled status, and days since last push. Flags likely-abandoned or unlicensed repos. Useful before depending on a repo.Check a GitHub repository's health signals: stars, forks, open issues, license, archived/disabled status, and days since last push. Flags likely-abandoned or unlicensed repos. Useful before depending on a repo.
| Paramètre | Type | Description |
|---|---|---|
| owner* | string | Repository owner (user or org) |
| repo* | string | Repository name |
email_address_validateValidate a single email address: RFC syntax check, MX record lookup on the domain, disposable/temporary-email-provider detection, and role-account detection (info@, admin@, etc.). Per-address check — different from email_deliverability_check, which audits a whole domain's sending reputation (SPF/DK…Validate a single email address: RFC syntax check, MX record lookup on the domain, disposable/temporary-email-provider detection, and role-account detection (info@, admin@, etc.). Per-address check — different from email_deliverability_check, which audits a whole domain's sending reputation (SPF/DK…
| Paramètre | Type | Description |
|---|---|---|
| email* | string | Email address to validate |
29 outils sur 29 ont publié une description.
Les noms et descriptions d’outils sont écrits par l’éditeur et affichés tels quels, comme du texte inerte. Ce sont les chaînes qu’un client MCP transmet à un modèle, alors Forge y recherche des motifs d’injection de prompt — tout constat apparaît avec l’analyse de sécurité ci-dessus. « Privilégié » est une correspondance de mot-clé sur le nom de l’outil, pas un audit de ce qu’il fait : un nom anodin peut tout de même tout faire.
29 pay-per-call DNS, SEO, SSL, security, and dev tools for AI agents. x402, no API key.
Les noms cliquables ouvrent l’index Forge de toutes les entrées observées exposant cet outil. Parcourir tous les outils indexés.
Cette entrée ne publie aucun paquet npm : Forge n'a donc pas d'arbre de dépendances pour elle. C'est une lacune de couverture — pas une affirmation qu'elle n'a aucune dépendance.